OpenSSL code beyond repair, claims creator of “LibreSSL” fork
OpenBSD founder Theo de Raadt has created a fork of OpenSSL, the widely used open source cryptographic software library that contained the notorious Heartbleed security vulnerability. — OpenSSL has suffered from a lack …
Context & Ripple Effects
Two weeks after the Heartbleed bug showed that anyone could read the memory of systems protected by vulnerable versions of OpenSSL, Theo de Raadt has concluded the library cannot simply be patched back to health and forked it as LibreSSL under the OpenBSD banner. The move is the sharpest response yet to what Ars describes as years of neglect — this is also the library behind a 'severe' 2010 vulnerability that broke public key crypto.
The pickup matters because of how wide it travelled: ZDNet, PC Pro, IT PRO and Help Net Security all ran the story on or about April 22, reflecting that OpenSSL sits underneath an enormous share of the internet's encrypted traffic, so any split in its development is an industry event rather than a niche open-source dispute.
First-order effects
- Operators still working through Heartbleed remediation now face a branching choice: stay on upstream OpenSSL's release path or evaluate LibreSSL, doubling testing and patch-management work during an already urgent cycle.
- The OpenSSL volunteer project comes under direct pressure to demonstrate maintainability, with its most visible critic now competing for the same downstream users.
Second-order effects
- Distributions, appliance vendors and hosting providers that bundle OpenSSL must decide which branch to ship, since a fragmented crypto base means security updates no longer land uniformly across the installed base.
- Funders and large technology companies that depend on the library face calls to resource it directly, because the fork argument — that the codebase is beyond repair — implicitly indicts everyone who relied on it without contributing.
Third-order effects
- If the pattern holds, critical internet infrastructure can no longer depend on thinly resourced volunteer maintenance: expect corporate-funded audits, paid core developers, and consolidation of trust around whichever branch proves it can respond fastest.
- A lasting LibreSSL/OpenSSL split would push the industry toward treating cryptographic libraries as replaceable components with competing implementations, rather than a single shared dependency nobody owns.
The trend: Heartbleed is turning underfunded open-source security infrastructure from a shared assumption into a contested market, where major players fork or fund the libraries everyone else depends on.